CakePHP Cache Corruption Code Execution

CakePHP is a popular PHP framework for building web applications. The Security component of CakePHP versions 1.3.5 and earlier and 1.2.8 and earlier is vulnerable to an unserialize attack which could be abused to allow unauthenticated attackers to execute arbitrary code with the permissions of th...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php. In conjunction with the authentication bypass issue, the 'jlist' parameter in propertybox.php can be used to execute arbitrary system commands. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Module...

Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow

This exploit takes advantage of a stack based overflow. Once the stack corruption has occurred it is possible to overwrite a pointer which is later used for a memcpy. This gives us a write anything anywhere condition similar to a format string vulnerability. NOTE: The popsubfolders option is a...

Joomla 1.5.12 TinyBrowser File Upload Code Execution

This module exploits a vulnerability in the TinyMCE/tinybrowser plugin. This plugin is not secured in version 1.5.12 of joomla and allows the upload of files on the remote server. By renaming the uploaded file this vulnerability can be used to upload/execute code on the affected system. This modu...

EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the KeyWorks KeyHelp ActiveX Control KeyHelp.ocx 1.2.3120.0. This ActiveX Control comes bundled with EMC's Documentation ApplicationXtender 5.4. This module requires Metasploit: https://metasploit.com/download Current source:...

Sendmail SMTP Address prescan Memory Corruption

This is a proof of concept denial of service module for Sendmail versions 8.12.8 and earlier. The vulnerability is within the prescan method when parsing SMTP headers. Due to the prescan function, only 0x5c and 0x00 bytes can be used, limiting the likelihood for arbitrary code execution. This...

TikiWiki jhot Remote Command Execution

TikiWiki contains a flaw that may allow a malicious user to execute arbitrary PHP code. The issue is triggered due to the jhot.php script not correctly verifying uploaded files. It is possible that the flaw may allow arbitrary PHP code execution by uploading a malicious PHP script resulting in a...

Tomcat Administration Tool Default Access

Detect the Tomcat administration interface. The administration interface is included in versions 5.5 and lower. Port 8180 is the default for FreeBSD, 8080 for all others. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

MS03-020 Microsoft Internet Explorer Object Type

This module exploits a vulnerability in Internet Explorer's handling of the OBJECT type attribute. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS03-020 Microsoft Internet Explorer Object...

Symantec BackupExec Calendar Control Buffer Overflow

This module exploits a stack buffer overflow in Symantec BackupExec Calendar Control. By sending an overly long string to the "DOWText0" property located in the pvcalendar.ocx control, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

SAP MaxDB cons.exe Remote Command Injection

SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP MaxDB...

Kazaa Altnet Download Manager ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Altnet Download Manager ActiveX Control amd4.dll bundled with Kazaa Media Desktop 3.2.7. By sending an overly long string to the "Install" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

Windows Executable Download (http,https,ftp) and Execute

Download an EXE from an HTTPS/FTP URL and execute it This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 429 include Msf::Payload::Windows include Msf::Payload::Single include...

SIPfoundry sipXezPhone 0.35a CSeq Field Overflow

This module exploits a buffer overflow in SIPfoundry's sipXezPhone version 0.35a. By sending an long CSeq header, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the affected application. This module requires Metasploit:...

3Com 3CDaemon 2.0 FTP Username Overflow

This module exploits a vulnerability in the 3Com 3CDaemon FTP service. This package is being distributed from the 3Com web site and is recommended in numerous support documents. This module uses the USER command to trigger the overflow. This module requires Metasploit:...

FTP Fetch, Reverse TCP Stager with UUID Support

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker with UUID Support Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows MessageBox

Fetch and execute an x86 payload from an FTP server. Spawns a dialog via MessageBox using a customizable title, text & icon Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...

FTP Fetch, Windows x64 Bind Named Pipe Stager

Fetch and execute an x64 payload from an FTP server. Listen for a pipe connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x64 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Reverse TCP Stager with UUID Support

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker with UUID Support Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an FTP server. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options...

FTP Fetch, Reverse Ordinal TCP Stager (No NX or Win7)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options...

FTP Fetch, Bind TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for a connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP...

FTP Fetch, Windows Executable Download (http,https,ftp) and Execute

Fetch and execute an x86 payload from an FTP server. Download an EXE from an HTTPS/FTP URL and execute it Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse TCP Stager (DNS)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)

Fetch and execute an x64 payload from an FTP server. Tunnel communication over HTTP Windows x64 winhttp Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Hidden Bind TCP Stager

Fetch and execute an x86 payload from an FTP server. Listen for a connection from a hidden port and spawn a command shell to the allowed host. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows Interactive Powershell Session, Reverse TCP SSL

Listen for a connection and spawn an interactive powershell session over SSL Module Options msf use payload/windows/x64/powershellreversetcpssl msf payloadpowershellreversetcpssl show actions ...actions... msf payloadpowershellreversetcpssl set ACTION msf payloadpowershellreversetcpssl show optio...

Coolnovo Credential Gatherer

This module searches for Coolnovo credentials on a Windows host. Module Options msf use post/windows/gather/credentials/coolnovo msf postcoolnovo show actions ...actions... msf postcoolnovo set ACTION msf postcoolnovo show options ...show and set options... msf postcoolnovo run This module requir...

macOS cfprefsd Arbitrary File Write Local Privilege Escalation

This module exploits an arbitrary file write in cfprefsd on macOS use exploit/osx/local/cfprefsd/racecondition msf undefinedracecondition show actions ...actions... msf undefinedracecondition set ACTION msf undefinedracecondition show options ...show and set options... msf undefinedracecondition...

Unix Command Shell, Bind TCP (via jjs)

Listen for a connection and spawn a command shell via jjs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 795 include Msf::Payload::Single include Msf::Sessions::CommandShellOption...

APT Package Manager Persistence

This module will run a payload when the package manager is used. No handler is ran automatically so you must configure an appropriate exploit/multi/handler to connect. This module creates a pre-invoke hook for APT in apt.conf.d. The hook name syntax is numeric followed by text. This module requir...

AwindInc SNMP Service Command Injection

This module exploits a vulnerability found in AwindInc and OEM'ed products where untrusted inputs are fed to ftpfw.sh system command, leading to command injection. A valid SNMP read-write community is required to exploit this vulnerability. The following devices are known to be affected by this...

IBM WebSphere MQ Channel Name Bruteforce

This module uses a dictionary to bruteforce MQ channel names. For all identified channels it also returns if SSL is used and whether it is a server-connection channel. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows SMB Multi Dropper

This module dependent on the given filename extension creates either a .lnk, .scf, .url, .xml, or desktop.ini file which includes a reference to the specified remote host, causing SMB connections to be initiated from any user that views the file. This module requires Metasploit:...

Command Shell, Bind TCP (via python)

Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+. module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Python include Msf::Sessions::CommandShellOptions def initializeinfo =...

Python Meterpreter Shell, Bind TCP Inline

Connect to the victim and spawn a Meterpreter shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Python include...

vBulletin 5.1.2 Unserialize Code Execution

This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 Module Options msf use exploit/multi/http/vbulletin/unserialize msf undefinedunserialize show actions ...actions... msf undefinedunserialize set ACTION msf undefinedunserialize show options ...show and set...

F5 iControl iCall::Script Root Command Execution

This module exploits an authenticated privilege escalation vulnerability in the iControl API on the F5 BIG-IP LTM and likely other F5 devices. This requires valid credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, 11.5.x use...

Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)

This module will bypass Windows UAC by utilizing the missing .manifest on the script host cscript/wscript.exe binaries. Module Options msf use exploit/windows/local/bypassuac/vbs msf undefinedvbs show actions ...actions... msf undefinedvbs set ACTION msf undefinedvbs show options ...show and set...

SysAid Help Desk Administrator Account Creation

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to create an administrator account. Note that this exploit will only work once. Any subsequent attempts will fail. On the other hand, the credentials must be verified manually. This module has been tested...

Windows Drive Formatter

This payload formats all mounted disks in Windows aka ShellcodeOfDeath. After formatting, this payload sets the volume label to the string specified in the VOLUMELABEL option. If the code is unable to access a drive for any reason, it skips the drive and proceeds to the next volume. This module...

Windows Outbound-Filtering Rules

This module makes some kind of TCP traceroute to get outbound-filtering rules. It will try to make a TCP connection to a certain public IP address this IP does not need to be under your control using different TTL incremental values. This way if you get an answer ICMP TTL time exceeded packet fro...

Firefox Gather History from Privileged JavaScript Shell

This module allows collection of the entire browser history from a Firefox Privileged JavaScript Shell. Module Options msf use post/firefox/gather/history msf undefinedhistory show actions ...actions... msf undefinedhistory set ACTION msf undefinedhistory show options ...show and set options... m...

Firefox Gather Passwords from Privileged JavaScript Shell

This module allows collection of passwords from a Firefox Privileged JavaScript Shell. Module Options msf use post/firefox/gather/passwords msf undefinedpasswords show actions ...actions... msf undefinedpasswords set ACTION msf undefinedpasswords show options ...show and set options... msf...

The EICAR Encoder

This encoder merely replaces the given payload with the EICAR test string. Note, this is sure to ruin your payload. Any content-aware firewall, proxy, IDS, or IPS that follows anti-virus standards should alert and do what it would normally do when malware is transmitted across the wire. This modu...

GetGo Download Manager HTTP Response Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in GetGo Download Manager version 5.3.0.2712 earlier, caused by an overly long HTTP response header. By persuading the victim to download a file from a malicious server, a remote attacker could execute arbitrary code on the system o...